afv-library/skills/integration-connectivity-generate/assets/named-credentials/oauth-jwt-bearer.namedCredential-meta.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
    Named Credential Template: OAuth 2.0 JWT Bearer Flow

    Use Case: Server-to-server with certificate-based authentication
    - CI/CD pipelines
    - Backend service integrations
    - Automated jobs requiring strong authentication

    Prerequisites:
    1. Create certificate in Setup → Certificate and Key Management
    2. Create Connected App with JWT Bearer enabled
    3. Upload public certificate to external system
    4. Pre-authorize Connected App for users

    Setup Steps:
    1. Replace all {{placeholder}} values
    2. Ensure certificate is uploaded
    3. Configure Connected App for JWT
    4. Deploy to org

    File Location: force-app/main/default/namedCredentials/{{CredentialName}}.namedCredential-meta.xml
-->
<NamedCredential xmlns="http://soap.sforce.com/2006/04/metadata">
    <fullName>{{CredentialName}}</fullName>
    <label>{{CredentialLabel}}</label>

    <!-- Base URL for the external service -->
    <endpoint>{{BaseEndpoint}}</endpoint>

    <!-- Authentication Configuration -->
    <principalType>NamedUser</principalType>
    <protocol>Oauth</protocol>

    <!-- JWT Bearer Settings -->
    <oauthTokenEndpoint>{{TokenEndpoint}}</oauthTokenEndpoint>
    <oauthScope>{{Scopes}}</oauthScope>

    <!--
    Certificate for signing JWT assertions
    Must exist in Setup → Certificate and Key Management
    -->
    <certificate>{{CertificateName}}</certificate>

    <!-- Auth Provider (configure for JWT Bearer) -->
    <!-- <authProvider>{{AuthProviderName}}</authProvider> -->

    <!-- Request Options -->
    <generateAuthorizationHeader>true</generateAuthorizationHeader>
    <allowMergeFieldsInBody>true</allowMergeFieldsInBody>
    <allowMergeFieldsInHeader>true</allowMergeFieldsInHeader>

    <!--
    JWT Bearer Flow Details:
    1. Salesforce creates JWT assertion signed with certificate
    2. JWT is sent to token endpoint
    3. External system validates signature
    4. Access token returned
    5. Access token used for API calls

    JWT Claims (automatically generated):
    - iss: Client ID
    - sub: Username (for SF-to-SF) or service account
    - aud: Token endpoint
    - exp: Expiration timestamp
    -->
</NamedCredential>